Windows Login Token Reuse in wolfSSHd

Executive Summary

This vulnerability affects the Windows port of wolfSSHd. When password or public key authentication is used, the Windows logon token for one connection is not released before a new token is acquired for another connection. This allows a less privileged user to exploit the issue and force a login as a more privileged user.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking if your wolfSSHd Windows version is affected. Verify the installed version using commands like 'wolfsshd -v' or checking the binary metadata. Inspect logs for unusual login patterns where a lower-privileged user gains higher privileges. Monitor Windows Event Logs for failed and successful SSH logins, focusing on token acquisition events.

Useful 0 Not Useful 0

Impact Analysis

A less privileged user with a valid account on the server could exploit this to gain unauthorized access as a more privileged user. This could lead to privilege escalation, unauthorized data access, or system control depending on the server's configuration.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade wolfSSH to the latest version where the token handling issue is fixed. If upgrading is not possible, disable password and public key authentication on the Windows wolfSSHd server. Restrict SSH access to trusted networks and users. Monitor for unauthorized privilege escalations and review authentication logs regularly.

Useful 0 Not Useful 0